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Lifting the veil of invisibility 


It is timely to focus on children as key stakeholders in the digital ecosystem as we look towards 25 May 2018 and 
the application of the General Data Protection Regulation: (GDPR) across Europe. Post 25 May 2018, for the first 
time there will be a data protection law at EU level which lifts the veil of invisibility that some would say has 
hitherto shrouded child users of online and digital services. As recent academic research has highlighted, an 
estimated one third of internet users across the globe are under 18s.s However, as child safety organisations 
such as the Irish Society for the Prevention of Cruelty to Children have pointed outs, these internet users are 
often operating in a world that was not originally designed with them in mind and still fails to recognise them as 
key players. However, from 25 May 2018, children are very much at the front and centre of the data protection 
landscape in Europe. The GDPR attributes special protection to children and so it will shine an unremitting 
spotlight upon data controllers in relation to safeguarding child users of online services. Effective protection of 
children in the labyrinthine online and digital environments will involve enabling children to exercise their legal 
and fundamental rightssin a way that minimises the risks to them. This in turn means maximising children’s 
understanding of the cyberterrain they inhabit as a large part of their everyday lives. As Recital 38sof the GDPR 
states: Children merit specific protection with regard to their personal data as they may be less aware of the risks, 
consequences and safeguards concerned and their rights in relation to the processing of personal data. Central 
to that core issue of understandability and awareness is the obligation of transparency upon data controllers 
under the GDPR. 


Transparency — a reconstructed and recalibrated obligation 


Transparency under the GDPR7is not so much a brand new concept in the data protection regulatory regime as a 
reconstructed and recalibrated obligation, albeit one that has now been very much shunted centre stage. Anyone 
who has ever ‘gone online’ will be familiar with the concept of privacy policies or privacy statements on websites 
which data controllers are required to provide as part of the obligation of fair processing of personal data under 
the current EU law, the 1995 Data Protection Directive.s That obligation of fair processing requires certain 
minimum information to be provided to data subjects, including the fact of their data being processed, why that 
processing is happening and who the data controller is. However, there has been an enduring apprehension 
about the utility of that limited information and whether it truly enables data subjects to take control of their 
personal data. Such apprehension is particularly pertinent in an online context given that privacy policies and 
statements have traditionally been expressed in lengthy legalistic and specialist terms which can be difficult for 
the average adult user to understand, let alone comprehensible by child users.» 


Regulatory disquietude 


The online world with all its permutations is clearly an intrinsic part of children’s everyday lives, and it seems that 
the age at which children start regularly accessing the web is becoming lower and lower. According to Ofcomioin 
a report published in 2016, based on parents’ estimates 3-4 year olds are now spending an average of 8 hours 
and 18 minutes per week online. Arguably, 21s century children’s use of online services is effectively ubiquitous, 
with many children now more digitally literate than their parents — sharing photos and videos, sending messages, 
using social media platforms, playing games and accessing entertainment amongst other activities. The issue of 
transparency in services targeted at children has long been a topic of global concern in the data protection 
sphere. The International Conference of Data Protection and Privacy Commissioners has issued a number of 
resolutions11in recent years addressing children’s online privacy and the need for educational initiatives, and 
ventilating disquietude about the online encroachment into the private lives of children and the fact that children 
are often unaware that their information, habits and behaviour are being tracked online. Such regulatory anxiety 
was arguably validated by the results of the Global Privacy Enforcement Network Privacy Sweep of 201512 which 
saw 29 data protection regulators around the world, including the Irish Data Protection Commissioner and the 
Information Commissioner’s Office in the UK, examine a total of 1,494 websites and apps which were targeted at, 
or popular amongst, children. The results raised concerns particularly around the volume of children’s personal 
information that was collected by those websites and apps, and later shared with third parties. Among its findings, 
the study revealed that while 67 per cent of the sites and apps examined collected children’s personal data, only 
22 per cent tailored their data protection communications to children. 


‘Children merit specific protection’:s 


The understandability gap in information that data controllers must provide to individuals, particularly where those 
individuals are children, is what the newly enunciated transparency obligation under the GDPR seeks to address. 
The core transparency obligation is found in Article 12:40f the GDPR, with Article 12.1 requiring data controllers 
to take appropriate measures to provide the required information, related to processing of personal data, to data 
subjects in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The 
specific information that must be provided by the data controller to a data subject is now extensive (in comparison 
with the equivalent information requirements applicable under Articles 10 and 111s0f the 1995 Data Protection 
Directive) and is set out in Articles 1316 and 1417. It includes information about who the data controller is, how the 
personal data will be used, who it will be shared with, whether it will be transferred internationally, the period for 
which it will be stored, and very importantly, what the data subject's rights are — for example, the right to access, 
rectification, and erasure of personal data and to make a complaint with a data protection authority. Insofar as 
providing information to and communicating with children is concerned, it is hugely significant that Article 12.1 of 
the GDPR carves out an explicit transparency obligation on data controllers for any information which is 
‘addressed specifically to a child’.1s This ties in with Recital 5819 of the GDPR, which makes it clear that because 
children merit specific protection, any information and communication concerning the processing of a child’s data 
‘should be in such a clear and plain language that the child can easily understand’. 


Appropriate measures to achieve transparency 


So, what does this new GDPR transparency obligation mean in practical terms for data controllers, such as the 
tech giants that run the social media, gaming, messaging and photo-sharing websites and apps that are so 
popular with children? The answer to this is bound up in one of the most important phrases in Article 12, namely 
the requirement in Article 12.120that data controllers take ‘appropriate measures’ to provide the required 
information to data subjects in a concise, transparent, intelligible and easily accessible form. According to Article 
12.1, such information is to be provided in writing, or by other means, including where appropriate, by electronic 
means. However, the term ‘appropriate measures’ clearly does not provide a fixed benchmark for all data 
controllers. Instead, it denotes an inherent variability depending on the circumstances in which the data controller 
is processing personal data. Fundamental to a data controller’s ability to comply with the obligation to take 
‘appropriate measures’ to convey the necessary information to a data subject is that the data controller must first 
know their audience and then tailor the communication of the information to data subjects in a way that is 
appropriate to that audience. Therefore, if a data controller knows (as it should do) that its audience consists of, 
or includes, child users, then it should tailor its privacy information and communications so that child users can 
readily understand what is happening to their personal data and what their rights are. This necessitates the data 
controller assessing what the most effective modality will be for conveying the information required under Articles 
13 and 14 of the GDPR. Such an assessment may include a consideration of the content and accessibility of 
written statements, as well as the potential use of more visually based techniques such as cartoons, pictograms, 
infograms and videos. It should also involve an evaluation of the appropriateness of electronic tools such as 
layered information notices, pop-up notices, hover-over notices or voice alerts. Of course, central to such 
considerations is the type of device that is being used, and whether, for example, the device is a tablet, mobile 
phone or an internetof- things device (including so-called ‘smart’ toys). Whatever the device, it is essential that 
the measures chosen for conveying the information are appropriate to the device being used by the child. With 
written statements, the overriding requirement for clear and plain language means that privacy notices that are 
addressed to child users, or users including children, must employ a vocabulary, tone and style of the language 
that is appropriate to and resonates with children. This necessarily means no ‘legalese’, no technical terms, 
jargon or ambiguous phrases that are devoid of any real meaning and may be particularly difficult for children to 
understand. 


The biggest transparency challenge of all? 


However, the data protection transparency challenge is not simply about ensuring data controller organisations 
provide information and communicate in ways that children can understand. Privacy education is essential to 
encouraging an awareness amongst children of what their personal data is, what their rights are and what the 
risks are when they share their information online or digitally. No matter how accessibly or appealingly privacy 
information is presented on a website or an app used by children, if child users do not appreciate the significance 
of what that information is telling them, then the risk is that they will swipe right past it without taking any notice of 
it. So perhaps the biggest transparency challenge is getting children to want to understand how and why their 
personal data is used and processed. That challenge has to be embraced not only by data controllers but also by 
data protection authorities, policy makers, educators, and parents who all have vital roles to play when it comes 
to educating children and young people about their rights and risks online. The UK Children’s Commissioner, in 
the ‘Growing Up Digital’ taskforce reportzein January 2017, called for the creation of a digital citizenship 
programme to be compulsory in every school from the age of 4 to 14. Similar sentiments were echoed recently in 
submissionszs made to an Irish Parliamentary Committee on Children and Youth Affairs in the context of its 
examination of cyber security for children and young adults. Indeed, digital literacy is already a focus of many 
educational programmes but in addition to taking account of the more high profile risks around issues like cyber 
bullying and general online harassment which attract much attention, children also need to be educated about the 
perhaps more oblique risks arising from their personal data being collected in the digital ecosystem.21 Awareness 
of the right to transparency in personal data processing is growing, and societally it seems that there is 
movement in the right direction, particularly with the incoming GDPR obligations on transparency. However, 
arguably technology is currently winning the race over transparency in the privacy arena. There is still a lot of 
catching up to do in fostering a culture where children — and indeed adults — expect and seek out transparent 
information from those organisations who collect, use and profit from personal datazs so that children, and adults, 
can make smart, informed choices about how, and when, and to what extent, they chose to share their most 
invaluable asset — their personal data. 
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